Vulnerabilities / Shield Security – Smart Bot Blocking & Intrusion Prevention Security / WPSEC-2026-1882
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path in Traffic Log
High 7.2
CWE-79Fixed in 22.3.4
- ID
- WPSEC-2026-1882
- Plugin
- Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning (wp-simple-firewall)
- Affected
- all versions before 22.3.4
- Remediation
- Update to 22.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- Shield Security – Smart Bot Blocking & Intrusion Prevention Security on WPSec AttackSurface
- Fix released
- Published
Description
The Shield Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logged request path in all versions up to, and including, 22.3.2, due to insufficient output escaping when request log entries are returned to the admin Traffic log table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by sending a request with a crafted URL path to the site. The scripts run when an administrator views the Traffic log.
References
- https://wpsec.com/vuln/WPSEC-2026-1882/
- https://plugins.svn.wordpress.org/wp-simple-firewall/tags/22.3.4/
- https://wordpress.org/plugins/wp-simple-firewall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS